A private S3 bucket should remain inaccessible to public principals even if a developer accidentally adds a public policy. Which control should be evaluated?

1. Only a crawler schedule that skips the bucket.
2. A longer cache-control value on every object.
3. A bucket name containing the word private.
4. Appropriate S3 Block Public Access settings at the applicable account and bucket levels.